Compare the time for the execution

[praveenkpatidar]

Hello Champions,

I come across a very complex logic to tag jobs on its start time.

We have one calculated value, it can be Weekly or Daily based on Job Run start time.

Weekly= If the Job Start time is Saturday 4AM to Monday 6:PM
Daily = for remaining days in week.

If its date comparison we can easily do that. we can have cascaded if then else to check days and then time. Is there any smart way to do that ?

Thanks
Praveen

[somesoni2]

Assuming the field name is job_start_date and it's value is string. try like this

your base search | eval job_start_epoch=strptime(job_start_date,"%d/%m/%y %H:%M:%S") | eval dayOfWeek=lower(strftime(job_start_epoch,"%a")) | eval hour=tonumber(strftime(job_start_epoch,"%H") ) 
eval Type=if(dayOfWeek="sun" OR (dayOfWeek="sat" AND hour>=4) OR (dayOfWeek="mon" AND hour<=16 ),"Weekly","Daily"

[sundareshr]

Assuming this is a scheduled job that runs at different time, try add this to your search. If job start time is a field in you data, you can replace the now() with strptime of field

your base search |  eval tag=if(now()>relative_time(now(), "@w6+4h") AND now()<relative_time(now(), "@w1+6h"), "Weekly", "Daily")

[praveenkpatidar]

I think the answer should be

Convert the number of week and time in 24 hour. Combine them %w%H

if its more then 604(Saturday04AM) and less then 218(Monday6PM) then its weekly.
Else its daily

[somesoni2]

What is the format of field job start time?

[praveenkpatidar]

@samesoni2

%d/%m/%y %H:%M:%s